7cf74d0662e88b1b161022697b2fdcf1e9df70b2a4778857bf8c7051ec5634c0

General

Target

fc8bf67ecb8852715717ca8a3a14e6bd_JaffaCakes118.exe
Size

126KB
MD5

fc8bf67ecb8852715717ca8a3a14e6bd
SHA1

766b5fcac2da1a0e29de56024d1abcadfd6a0250
SHA256

7cf74d0662e88b1b161022697b2fdcf1e9df70b2a4778857bf8c7051ec5634c0
SHA512

91db4e291ba5fc6481cd1f902a6d086a03c3412f8cb40fbb42a9d1a1caabc3657932eb255b758b386b97972b7b291d416513aaf2f3ad7e80db09a0e25ed26764
SSDEEP

1536:pTWhwiiehaL5o7F4iKEFXvx9oFqWGVYL41YILk:pEvrwL5oJ/XU3

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2328	cmd.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	fc8bf67ecb8852715717ca8a3a14e6bd_JaffaCakes118.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fc8bf67ecb8852715717ca8a3a14e6bd_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Office loads VBA resources, possible macro or embedded object present

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	fc8bf67ecb8852715717ca8a3a14e6bd_JaffaCakes118.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1808	WINWORD.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1808	WINWORD.EXE
1808	WINWORD.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 1808	2684	fc8bf67ecb8852715717ca8a3a14e6bd_JaffaCakes118.exe	30
PID 2684 wrote to memory of 1808	2684	fc8bf67ecb8852715717ca8a3a14e6bd_JaffaCakes118.exe	30
PID 2684 wrote to memory of 1808	2684	fc8bf67ecb8852715717ca8a3a14e6bd_JaffaCakes118.exe	30
PID 2684 wrote to memory of 1808	2684	fc8bf67ecb8852715717ca8a3a14e6bd_JaffaCakes118.exe	30
PID 2684 wrote to memory of 2328	2684	fc8bf67ecb8852715717ca8a3a14e6bd_JaffaCakes118.exe	31
PID 2684 wrote to memory of 2328	2684	fc8bf67ecb8852715717ca8a3a14e6bd_JaffaCakes118.exe	31
PID 2684 wrote to memory of 2328	2684	fc8bf67ecb8852715717ca8a3a14e6bd_JaffaCakes118.exe	31
PID 2684 wrote to memory of 2328	2684	fc8bf67ecb8852715717ca8a3a14e6bd_JaffaCakes118.exe	31
PID 1808 wrote to memory of 2800	1808	WINWORD.EXE	33
PID 1808 wrote to memory of 2800	1808	WINWORD.EXE	33
PID 1808 wrote to memory of 2800	1808	WINWORD.EXE	33
PID 1808 wrote to memory of 2800	1808	WINWORD.EXE	33

C:\Users\Admin\AppData\Local\Temp\fc8bf67ecb8852715717ca8a3a14e6bd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fc8bf67ecb8852715717ca8a3a14e6bd_JaffaCakes118.exe"
1⤵
- Modifies system executable filetype association
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
  "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\fc8bf67ecb8852715717ca8a3a14e6bd_JaffaCakes118.doc"
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    PID:2800
- C:\Windows\SysWOW64\cmd.exe
  cmd /c del "C:\Users\Admin\AppData\Local\Temp\fc8bf67ecb8852715717ca8a3a14e6bd_JaffaCakes118.exe"
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Privilege Escalation

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Defense Evasion

Indicator Removal

1

T1070

File Deletion

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fc8bf67ecb8852715717ca8a3a14e6bd_JaffaCakes118.doc

Filesize
64KB

MD5
bbd2005f4c6ee5151995b54f8e24caa6

SHA1
ba63dd09b33d436d66db44e610641b74453b5fe0

SHA256
b9c4c9f58193a4d486f2a4d536e5dd201d7cfb562508b59a0ac9443f49261d5f

SHA512
c3d76efb4699c361c9d8611b164a0b51fdbced14ae24d7b4ca6f23d3130e5a8dbc094ba3f69e52cf941f42704b61098b5f39ddcc1ad6373ef36927e3361520da

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
19KB

MD5
11b155b93212d4e9a5927f32566eebb6

SHA1
f57e274ed5407d4aee94faf49e62ba8bf7a26fbc

SHA256
a3656ed527ee56a1d041d0e171823502c3a2d37c9821d57f3f4b5a13b8e6b726

SHA512
43652f74a1c4be44cedd38e89596b5d6c002b7008abe47f3898ffcea40bfbd09e85b3f783e6963f42c5ab38ec8d3190153a3d240d8b973eb25968babef07d2c6

Download Submit
memory/1808-6-0x000000002F4D1000-0x000000002F4D2000-memory.dmp

Filesize
4KB

Download
memory/1808-7-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1808-8-0x0000000070E4D000-0x0000000070E58000-memory.dmp

Filesize
44KB

Download
memory/1808-12-0x0000000070E4D000-0x0000000070E58000-memory.dmp

Filesize
44KB

Download
memory/1808-27-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads